feat(uci): integrate effect-bound verification chain

.claude.json

@@ -9,7 +9,7 @@
   "provenance": {
     "generator": "scripts/build-cognitive-manifest.py",
     "repository": "Aegis-Omega/AEGIS-OMEGA",
-    "source_ref": "feat/uci-1-collective-work-contract-v1",
+    "source_ref": "feat/uci-4-effect-chain-integration-v1",
     "parent_state_hash": "e9f0ec153b0b320a1e791092f73209442ec43a982e503203d9c101ec40949cba",
     "signature_mode": "GITHUB_OIDC_ATTESTATION"
   },
@@ -488,5 +488,5 @@
       "on_success": "broadcast-attested-verified-event-stream"
     }
   },
-  "state_hash": "c81e62a3a824d299e6ee2a2c78a243e48ba08d69aca3730f3e0f3495792bd0a0"
+  "state_hash": "eb3fdc4454eb6d6464afa8e331fee22e9e9b1bee8815dd59798ba199a821c8df"
 }

.github/workflows/uci-4-effect-chain-contract.yml

@@ -0,0 +1,124 @@
+name: UCI-4 Effect Chain Contract
+
+on:
+  pull_request:
+    branches:
+      - feat/uci-1-collective-work-contract-v1
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  uci4-effect-chain:
+    name: uci4 / effect-chain
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      EXPECTED_PARENT_SHA: ebec2f9c8fa00f54605d859df61512108ff3b71d
+      PR_BASE_SHA: ${{ github.event.pull_request.base.sha || '' }}
+    steps:
+      - name: Checkout exact candidate
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.CANDIDATE_SHA }}
+          fetch-depth: 0
+
+      - name: Record exact lineage
+        shell: bash
+        run: |
+          set -euo pipefail
+          actual="$(git rev-parse HEAD)"
+          test "$actual" = "$CANDIDATE_SHA"
+          test "$(git merge-base "$EXPECTED_PARENT_SHA" HEAD)" = "$EXPECTED_PARENT_SHA"
+          if [[ -n "$PR_BASE_SHA" ]]; then
+            test "$PR_BASE_SHA" = "$EXPECTED_PARENT_SHA"
+          fi
+          echo "CANDIDATE_SHA=$actual"
+          echo "EXPECTED_PARENT_SHA=$EXPECTED_PARENT_SHA"
+          echo "UCI4_EXACT_LINEAGE=PASS"
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install exact test runtime
+        run: python -m pip install pytest==8.3.5 jsonschema==4.23.0
+
+      - name: Validate UCI-4 schemas
+        shell: bash
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          import json
+          from pathlib import Path
+          from jsonschema.validators import validator_for
+
+          paths = [
+              Path('schemas/transition-identity-envelope.v1.schema.json'),
+              Path('schemas/decision-receipt.v1.schema.json'),
+              Path('schemas/execution-receipt.v1.schema.json'),
+              Path('schemas/effect-receipt.v1.schema.json'),
+              Path('schemas/effect-witness.v1.schema.json'),
+              Path('schemas/complete-verification-result.v1.schema.json'),
+          ]
+          for path in paths:
+              schema = json.loads(path.read_text(encoding='utf-8'))
+              validator_for(schema).check_schema(schema)
+              print(f'UCI4_SCHEMA_OK {path}')
+          print(f'UCI4_SCHEMA_COUNT={len(paths)}')
+          PY
+
+      - name: Run frozen proofline plus UCI integration falsifiers
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pytest \
+            sovereign-omega-v2/python/tests/test_transition_receipts_pr1.py \
+            sovereign-omega-v2/python/tests/test_transition_receipts_cli_pr1.py \
+            sovereign-omega-v2/python/tests/test_effect_adapters_pr2.py \
+            sovereign-omega-v2/python/tests/test_effect_verifier_pr3.py \
+            sovereign-omega-v2/python/tests/test_complete_verifier_pr4.py \
+            sovereign-omega-v2/python/tests/test_complete_verifier_pr4_receipt_binding.py \
+            sovereign-omega-v2/python/tests/test_uci4_effect_chain_integration.py \
+            -q | tee "$RUNNER_TEMP/uci4-pytest.log"
+          grep -Eq '85 passed' "$RUNNER_TEMP/uci4-pytest.log"
+          echo "UCI4_FULL_PROOFLINE_85=PASS"
+
+      - name: Write exact-head witness summary
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            echo "schema_version=AEGIS_UCI4_CI_WITNESS_V1"
+            echo "candidate_sha=$(git rev-parse HEAD)"
+            echo "expected_parent_sha=$EXPECTED_PARENT_SHA"
+            echo "authority=EVIDENCE_ONLY"
+            echo "frozen_parent_binding=REQUIRED_AND_TESTED"
+            echo "proofline_cardinality=85_REQUIRED_AND_TESTED"
+            echo "pull_request_trigger_scope=FROZEN_PARENT_BRANCH_ONLY"
+            echo "effect_witness_issuance=PROCESS_LOCAL_ADAPTER_ISSUED_ONLY"
+            echo "filesystem_descriptor_relative_open=REQUIRED_AND_TESTED_REFERENCE"
+            echo "filesystem_observation_size_bound=REQUIRED_AND_TESTED"
+            echo "cross_process_effect_witness_attestation=NOT_ESTABLISHED"
+            echo "concurrent_file_mutation_snapshot_proof=NOT_ESTABLISHED"
+            echo "atomic_admission=NOT_IMPLEMENTED"
+            echo "effect_bound_admission=UNAVAILABLE"
+            echo "production_admission=NOT_ESTABLISHED"
+          } > "$RUNNER_TEMP/uci4-witness.txt"
+          if [[ -f "$RUNNER_TEMP/uci4-pytest.log" ]]; then
+            cat "$RUNNER_TEMP/uci4-pytest.log" >> "$RUNNER_TEMP/uci4-witness.txt"
+          fi
+
+      - name: Upload UCI-4 witness
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: uci4-effect-chain-witness-${{ env.CANDIDATE_SHA }}
+          path: |
+            ${{ runner.temp }}/uci4-witness.txt
+            ${{ runner.temp }}/uci4-pytest.log
+          if-no-files-found: error

docs/audits/2026-08-20-uci4-effect-chain-lineage-ledger.md

@@ -0,0 +1,135 @@
+# AEGIS Ω UCI-4 Effect-Chain Lineage Ledger
+
+Date: 2026-08-20
+Status: IMPLEMENTED / EXTERNAL EXACT-HEAD COMPONENT WITNESS ESTABLISHED / FINAL PR-HEAD RECHECK PENDING
+Authority: EVIDENCE_ONLY
+
+## 1. Exact lineage
+
+```text
+CANONICAL_MAIN = 32b7eb6a37fb69d19dd80189390b6641c5004ef1
+UCI4_PARENT = ebec2f9c8fa00f54605d859df61512108ff3b71d   # PR #275 exact checkpoint
+SOURCE_EFFECT_LINEAGE = #268 -> #270 -> #272 -> #273
+SOURCE_EFFECT_LINEAGE_TIP = 6407db1b0c4176f67a1d7ecbb16eca77d131d87e
+UCI4_RED_CANDIDATE = 13a8ffbc907fc91751f84092b7befbbad47dd0f6
+UCI4_FIRST_GREEN_RUNTIME_CANDIDATE = 1cdd2c6331fcd2c18d75baf2c60b914dd30f4548
+```
+
+UCI-4 was created as a narrow successor of the UCI spine. The frozen effect-verification source files were transplanted by Git blob identity rather than by merging the historical stacked branches.
+
+## 2. Preserved semantic chain
+
+```text
+TransitionIdentity
+  -> DecisionReceipt
+  -> ExecutionReceipt
+  -> independent EffectWitness / EffectEvidence
+  -> EffectVerificationResult
+  -> verifier-gated EffectReceipt
+  -> CompleteVerificationResult
+```
+
+Mandatory boundaries remain:
+
+```text
+DecisionReceipt != ExecutionReceipt != EffectReceipt
+DEFER -> WAITING
+DEFER -/-> EXECUTE
+ExecutionReceipt -/-> EffectReceipt
+CompleteVerificationResult -/-> AdmissionRecord
+```
+
+Only `PERMIT` satisfies decision authority. Effect evidence originates from an independently bound observation adapter. No generic `EffectReceipt` producer exists. `CompleteVerificationResult=TRUE` remains verifier output only.
+
+## 3. TDD RED witness
+
+The preregistered UCI-4 integration test was committed before the production SDK surface.
+
+A first external witness attempt was invalid as RED evidence because the runner lacked `pytest` and the initial shell harness did not fail closed after capturing the command exit code. That result was rejected rather than promoted.
+
+The corrected independent witness used `pytest==8.3.5` and checked out the exact candidate:
+
+```text
+RUNNER_REPOSITORY = tarikskalic33/info
+RUN_ID = 32347655528
+JOB_ID = 96359724715
+CANDIDATE_SHA = 13a8ffbc907fc91751f84092b7befbbad47dd0f6
+EXPECTED_PARENT_SHA = ebec2f9c8fa00f54605d859df61512108ff3b71d
+EXACT_LINEAGE = PASS
+```
+
+Observed intended RED failure:
+
+```text
+ModuleNotFoundError: No module named 'harness.sdk.transition_receipts'
+UCI4_RED_INTENDED_MISSING_TRANSITION_RECEIPTS = PASS
+```
+
+## 4. GREEN implementation witness
+
+The production transplant commit reused the exact tested Git blobs from the frozen #273 proofline for the transition/effect runtime, schemas, authority producers, and PR1→PR4 falsification suites.
+
+Independent hosted execution then checked out exact candidate:
+
+```text
+RUNNER_REPOSITORY = tarikskalic33/info
+RUN_ID = 32348141772
+JOB_ID = 96361208538
+CANDIDATE_SHA = 1cdd2c6331fcd2c18d75baf2c60b914dd30f4548
+UCI_PARENT_SHA = ebec2f9c8fa00f54605d859df61512108ff3b71d
+FROZEN_SOURCE_TIP = 6407db1b0c4176f67a1d7ecbb16eca77d131d87e
+EXACT_LINEAGE = PASS
+```
+
+Observed:
+
+```text
+UCI4_SCHEMA_VALIDATION = 6/6 PASS
+PR1_TO_PR4_PLUS_UCI4_TESTS = 79/79 PASS
+FAILURES = 0
+```
+
+The executed set was:
+
+- `test_transition_receipts_pr1.py`
+- `test_transition_receipts_cli_pr1.py`
+- `test_effect_adapters_pr2.py`
+- `test_effect_verifier_pr3.py`
+- `test_complete_verifier_pr4.py`
+- `test_complete_verifier_pr4_receipt_binding.py`
+- `test_uci4_effect_chain_integration.py`
+
+This establishes an external exact-head component witness for the first GREEN runtime candidate. It is not AEGIS repo-native CI and does not establish admission.
+
+## 5. Scope and contamination check
+
+Relative to `#275@ebec2f9c...`, the UCI-4 slice is limited to:
+
+- transition/effect SDK modules;
+- canonical authority client/CLI receipt emission;
+- six closed schemas;
+- frozen PR1→PR4 falsification tests;
+- one UCI integration test;
+- dedicated UCI-4 workflow;
+- implementation/audit documentation;
+- repository-generated `.claude.json` provenance refresh.
+
+No provider-organism, memory, UI, cloud deployment, billing, domain capability, or AtomicAdmission implementation is included.
+
+## 6. Explicit non-claims
+
+```text
+ATOMIC_ADMISSION = NOT_IMPLEMENTED
+EFFECT_BOUND_ADMISSION = UNAVAILABLE
+CAUSAL_CLAIM_ADMISSION = NOT_IMPLEMENTED
+PRODUCTION_ADMISSION = NOT_ESTABLISHED
+DISTRIBUTED_LINEARIZABILITY = NOT_ESTABLISHED
+PRODUCTION_ROBUSTNESS = NOT_ESTABLISHED
+AGI = NOT_ESTABLISHED
+```
+
+Provider/model output remains evidence only, never authority. D3 remains explicitly operator-approval-bound. D4 remains denied absent separately admitted policy.
+
+## 7. Next gate
+
+The final PR head after CI/ledger-only changes requires a fresh exact-head witness. No earlier GREEN run may be presented as PASS for a later SHA. UCI-5 AtomicAdmission remains a separate successor and must not be folded into this proofline by assertion.